First kustomize helm chart thing.

As of commit time, woodpecker chart does not support agents in separate namespace.

Render it locally:

```sh
kustomize build . --enable-helm
```

If upstream chart does not have `extraSecretNamesForEnvFrom`, patch instead:

```yaml
patches:
- target:
  version: v1
  kind: StatefulSet
  name: release-name-server
  # or: labelSelector: app.kubernetes.io/name=server
  patch: |-
   - op: add
     path: /spec/template/spec/containers/0/envFrom/-
     value:
       secretRef:
         name: woodpecker-gitea-oauth2
```